The Daily Index — Friday, April 18, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

CRITICAL ERLANG/OTP SSH VULNERABILITY (CVSS 10.0) ALLOWS UNAUTHENTICATED CODE EXECUTION

A critical vulnerability (CVE-2025-32433) in Erlang/OTP's SSH implementation allows attackers to execute arbitrary code without authentication. The flaw received a maximum CVSS score of 10.0. Affecting all SSH servers using the Erlang/OTP SSH library, it enables unauthenticated attackers to send protocol messages before authentication. Users are advised to update ASAP.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

MINISTER'S X ACCOUNT HACKED TO PROMOTE CRYPTO SCAM

The head of the UK's House of Commons Lucy Powell's X account was hacked to promote a new scam cryptocurrency. The post described a new community-driven digital currency known as $HCC. Analysts noted that there had been only 34 transactions for the coin resulting in a profit of around £225.

bbc.com · 2 min

TLDR InfoSec

INVOKING MISCONFIGURED API GATEWAYS FROM ANY EXTERNAL AWS ACCOUNTS

Private API Gateways in AWS are not internet accessible but are accessible to anyone in the AWS networks. Users who don't realize this can misconfigure the API Gateway with a Principal of ‘*' with the intention of allowing access from any VPC in their account, but are actually opening it to any VPC in AWS. This attack generally cannot be exploited without some initial access or knowledge of the API Gateway endpoint and REST API spec.

offensai.com · 6 min

TLDR InfoSec

HOW I GOT HACKED: A WARNING ABOUT MALICIOUS POCS

Summary unavailable

chocapikk.com · 11 min

TLDR InfoSec

EVERYONE KNOWS YOUR LOCATION, PART 2: TRY IT YOURSELF AND SHARE THE RESULTS

This post discusses a method for analyzing mobile app data sharing and provides a Python notebook and guide to enable anyone to monitor and investigate how apps share location and other personal data. The author has created visualization tools showing how adtech companies like Unity dominate mobile game traffic, with hundreds of data requests happening within seconds of opening an app. The guide walks readers through setting up mitmproxy to intercept mobile traffic, recording app sessions, and analyzing the captured data to discover what personal information is being shared with third parties.

timsh.org · 9 min

TLDR InfoSec

PILLAR SECURITY (PRODUCT LAUNCH)

Pillar Security provides security controls throughout the entire AI lifecycle, from integrating with existing code repositories and data infrastructures to mapping AI models, datasets, and frameworks.

pillar.security

TLDR InfoSec

CORSHA(PRODUCT LAUNCH)

Corsha provides a machine identity platform (m-IdP) that authenticates, manages, and governs the growing traffic between machines, facilitating secure multi-factor authentication (MFA) between any machines.

corsha.com

TLDR InfoSec

FLORIDA DRAFT LAW MANDATING ENCRYPTION BACKDOORS FOR SOCIAL MEDIA ACCOUNTS BILLED ‘DANGEROUS AND DUMB'

Florida's draft bill, which requires social media companies to implement encryption backdoors for law enforcement, has advanced to the Senate floor. The "Social Media Use by Minors" legislation would also require parental access to children's accounts and prohibit the use of disappearing messages for minors. Critics argue the bill would compromise security and make users less safe.

techcrunch.com · 3 min

TLDR InfoSec

MCP IS THE NEW INTERFACE FOR SECURITY TOOLS

MCP servers are the future of security as they can unify disparate security tooling, handle the massive amounts of data used in security, and enable security professionals who don't know how to code. MCP servers offer a fully customized, single-pane-of-glass interface for organizations. Authentication and auditing remain issues that need to be implemented outside of the spec.

mayakaczorowski.com · 4 min

TLDR InfoSec

DPRK IT WORKERS IN OPEN SOURCE AND FREELANCE PLATFORMS

This document details a two-month investigation by cybersecurity researchers who discovered North Korean IT workers infiltrating legitimate open-source projects, particularly through the freelance platform onlyDust. The researchers identified three leading actors (0xExp-po, bestselection18/Hiroto Iwaki, and aidenwong812/cryptogru812) who created elaborate false identities, manipulated commit histories, and received payments totaling at least $1,874 across 11 repositories while contributing 62 pull requests. The investigation highlights serious security risks, including potential supply chain attacks, as these DPRK IT workers often collaborate with North Korean hacking teams to identify targets and establish initial access for future attacks.

ketman.org · 12 min

TLDR InfoSec

AWSSECURITYCHANGES (WEBAPP)

Monitor AWS documentation changes and security updates in real-time and track modifications across all AWS services to stay informed about critical security changes.

awssecuritychanges.com

TLDR InfoSec

HOUSE INVESTIGATION INTO DEEPSEEK TEASES OUT FUNDING, SECURITY REALITIES AROUND CHINESE AI TOOL

A House report warns that DeepSeek, a Chinese AI tool, poses national security and economic risks to the U.S. due to its low cost, ties to Chinese entities, and use for intelligence gathering on Americans, and recommends stricter export controls and closer monitoring of emerging AI technologies.

cyberscoop.com · 4 min

TLDR InfoSec

MICROSOFT: OFFICE 2016 AND OFFICE 2019 REACH END OF SUPPORT IN OCTOBER

Microsoft Office 2016 and 2019 will lose support after October 14, so users are advised to upgrade to Microsoft 365 or Office 365 to avoid security risks and maintain support.

bleepingcomputer.com · 2 min